Extended card file system

The present invention relates to electronic data carrier file systems. In particular, the present invention relates to file systems for small hand held data carriers, particularly for SmartCards.

A new area of technology with increasing importance is represented by the increasing use and acceptance of SmartCards and their applications for many different purposes.

Such applications need the ability to store data on media so that they can be retrieved at a later point in time. Under normal circumstances they use the file interface provided by the operating system on which the application is running. The operating system makes use of file systems to store the data on hardware and to keep the data consistent. Since SmartCards are not natively supported by any operating system this mechanism cannot be used for SmartCard enabled applications. SmartCards, have a static file system implemented into their functionality, i.e. the data stored on a smart card has to be described at the time the card is issued. Dynamic file allocation is therefore either not possible or very hard to accomplish.

Furthermore, dynamic file sizes are not supported by the ISO 7816 SmartCard file system.

Creating a new data file for each data object to store will be an ineffective way to store the data, because the file system overhead will reduce card free space and performance. Storing multiple data objects in one elementary file on the card will reduce the overhead of file headers, but a problem of ineffective accessing of the data objects still exists. Reserving fixed length records will waste file system space on the card.

Changing of file size can only be implemented by re-initializing the cards, which is only possible as long as they are not finalized, (i.e. closed before distribution to the end-users). Issuing open (i.e. not finalized) cards is not acceptable due to security reasons. In addition, files cannot be addressed by logical file names, but must rather be addressed by their file identifiers. This requires more effort and is not helpful for rapid prototyping efforts.

Further, the implementation of a dynamic file system onto a SmartCard imposes new problems since existing file systems generally depend on things like pre-allocated directories, cluster models, allocation bitmaps, etc. Since memory is always constrained on SmartCards and special problems like unexpected card-removal, fragmentation of files, and card diversity are always present, a new file system for the SmartCard needs to be developed.

Therefore, the primary object of the present invention is to provide a more flexible, improved file system.

It is another object of the present invention to provide such system which is compliant to the ISO 7816 SmartCard file system standard.

It is another object of the present invention to provide such file system with maximum utilization of the free card memory space.

A further object is to improve data security and consistency of such cards.

The foregoing and other objects are realized by the Extended SmartCard file system which resides in one flat file within the ISO file system of the SmartCard.

A second file, containing user information like size of the file system, owner information, and key fields, is used to configure the file system driver dynamically. However, this file may be omitted if the file system driver is statically initialized.

The nested file system of the present invention has the advantage, in relation to the method sketched out in the discussion of prior art technique that files can be fully dynamically accessed and edited without affecting the underlying ISO file layout, i.e. the outer fixed structure of the outer file system.

In a preferred embodiment of the inventive data managing method, data integrity and consistency are achieved by a transaction-oriented commit concept.

Additionally, all security mechanisms of the underlying SmartCards, in terms of data protection, are fully maintained. Moreover the security mechanisms are enhanced in cases of power loss or unexpected card removal since two distinct directories are provided for data management.

Further, the data storage supports human readable file names and fragmented file allocation, such that data can be stored in chunks, and the file system incorporates a defragmenting function.

Further, data compress and decompress operations are supported.

The present invention is illustrated by way of example and is not limited by the shape of the Figures of the accompanying drawings in which:

FIG. 1 is a schematic sketch showing the overall structure and the organization of a preferred embodiment of the file system according to the invention, in the first row the overall system, and the following rows showing zoomed portions of the respective upper row,

FIG. 2 is a schematic sketch showing the increasing storage of data at different times, each row corresponding at a particular time.

With general reference to the Figures and with special reference now to FIG. 1 the overall structure and organization of a preferred embodiment of the file system 8 according to the invention is described in more detail. In the upper row of the Figure the overall system is shown, and the following rows thereunder each show zoomed portions of the respective upper row.

The overall file system 8 has two outer files 10 , 12 in order to comply with ISO 7816. The overall file system size is thus fixed. The second file 10 is a small one compared to the first one 12 and contains information concerning the size of the overall file system, owner information and a key field. The first file 12 contains directory information in a first portion 14 starting at the front end 15 of the first file 12 and being delimited by a line 17 , and user data 21 in a second portion 16 between the back end 19 and a line 20 . Between the two is a first free space 18 available for being written basically with user data and to a small extent with directory information.

User data is deemed to contain generally the information essential for the business process in which the SmartCard is applied, (i.e. in case of a patient's medical insurance SmartCard, it could be data reflecting the patient's historic progress relative to particular diseases, etc.).

In the present preferred embodiment the directory information is maintained double at two distinct places 22 and 24 within the first portion 14 . This is described in more detail in context with the inventive storing method down below.

Thus the first file's 12 basic layout can be summarized as follows:

“<DIRECTORY 1 ><SMALL FREE SPACE><DIRECTORY 2 ><LARGE FREE SPACE><FILE DATA>”

The layout of the file system is intentionally kept very simple. The two directories are placed at the beginning of the file space, and the user data is appended from the end. This simplicity enables low-end devices to access the file system 8 , too.

Within the file system 8 all administration data is saved according to a preferred schema <LENGTH><DATA><CRC>” as it is shown in the second row of FIG. 1 . In a data field 30 the particular use information is stored, the length field 28 describes the byte length of the data field 30 , and (to insure that use data is correct) all important information blocks are appended by their respective cyclic redundancy check codes, for example, commonly used check sums, referred to as CRC. This insures that data read can be treated as trustworthy or not, since data existence and correctness can be controlled by first finding the length field, then advancing by the offset given by said length and then finding at this location a CRC which guarantees for data correctness in space there between.

The directory fields 22 , 24 , file-entries 34 , and files, the latter two to be described down below—are structured according to that schema.

Thus, the basic layout of the directory information 22 and 24 is as follows:

“DIRECTORY 1 [<LENGTH><DATA><CRC>],DIRECTORY 2 [<LENGTH><DATA><CRC>]”

Thus, each of the directories 22 , 24 has a length indication 28 covering the whole length of directory data 30 which is composed of a plurality of file entries 34 . The correctness is checked by a first error detection scheme with the help of a checksum CRC 32 . Further, by fields 28 and 32 a safe envelope is formed to separate the data contents of data 30 from the rest of the file system.

The basic function of the two directories is to provide a method of assuring consistency of the file system. When a new file is added on the file system 8 the data are updated, then both directories 22 , 24 are updated—directory 22 first, then the directory 24 .

Modifying is done in the order LENGTH, DATA, CRC. If the card holding the file system 8 is pulled from the reader during writing one of the directories will be inconsistent with the data while the other one will be correct.

The first directory 22 entry starts at block zero in the file system. The second directory 24 starts after the first, but at a multiple of 2 n , wherein n can be determined at file system driver build time.

This means that there is a small block of free space 26 behind directory 22 . This is left free, so succeeding file allocations can be performed faster. In the event that this second free-space 26 between directory 22 and directory 24 turns out to be not large enough, directory 24 gets moved to the next free multiple of 2 n . In this event directory 24 gets updated before directory 22 . If the card is removed during this operation, then, the file system can still be repaired, since directory 22 is either consistently reflecting the old state or directory 24 is already activated and reflecting the correct new state. This can happen when directory 22 is not valid anymore, or when the file system driver is able to look for a valid directory at all multiples of 2 n .

Thus, the possible errors like defective directories, overlapping file, fragmentation indications, etc., from previous sessions are recovered by the file system driver as they can be found and corrected automatically with the above described consistency management.

With reference to the third and fourth row of FIG. 1 the layout of every file entry 34 in the directories 22 , 24 is as follows:

“<LENGTH><DATA><CRC>” where DATA breaks up into

Again, the layout is based upon the basic structure defined above for data entries within the file system. A first field 36 contains length information describing the total length of the directory file entry 34 . A second field 38 contains length information relating to the file name in the subsequent field 40 . Thus, file entries can be taken as plain text.

Next, in a position field 42 the start block and the end block of the user data file corresponding to the directory file entry 34 are written.

Next, in an attribute field 44 there may be additional attributes like time stamp, originator, etc., stored for each data object entry. This information can be advantageously used for a pre-selecting procedure, before reading the selected file itself. The attribute field 44 contained in the structure is an optional field. Its use can be decided upon by the application designer.

Finally, again a CRC field 46 completes the directory file entry 34 . Thus, a second error detection scheme is established in order to control the correctness of each file entry 34 .

Thus, by reading and processing the data contained in each file entry 34 the particular corresponding file located in the second portion 16 of the second file 12 can be found and read. Next, with additional reference to FIG. 2 the free space management will be described in more detail.

In FIG. 2 the increasing storage of data in the file system 8 by accumulating data in time is shown to different times, each row corresponding to a particular time. Time increases in down direction.

The second file 10 size remains constant in time. As indicated already above the directories 22 , 24 grow from the beginning to the end of the card and the occupied file space 16 grows from the end to the beginning. The logical free-space 18 on the card is calculated by subtracting the used file space from the total space of the file system where the position of the second directory multiplied by 2 yields the length of directory entries which is included in that calculation. This calculation can be automatically done by the driver from mount time on.

As can be seen from the drawing, free space 18 located after directories 22 , 24 is reduced when time increases. The inter-directory free space 26 is large enough for holding the file entries 34 necessary for managing data in the second portion 16 of the second file 12 . Further, the size of the second file 12 is not changed during data accumulation, for example, because the number of file entries 34 was small enough.

When a SmartCard user wants to extend the file system by a file entry he calls to write a file. After mounting the card in a card reading device the file system driver allocates file space and directory space. Next, it writes the file data to the SmartCard. Then the driver appends a new directory entry 34 to directory 22 . Then, the driver appends the same new directory 34 entry to directory 24 , with all writing procedures performing the schema described above, i.e. <LENGTH><DATA><CRC>.

In the foregoing specification the invention has been described with reference to a specific exemplary embodiment thereof. It will, however, be evident that various modifications and changes may be made thereto without departing from the broader spirit and scope of the invention as set forth in the appended claims. The specification and drawings are accordingly to be regarded as illustrative rather than in a restrictive sense.